Adding Value Through Risk and Capital Management

Transcription

1 Adding Value Through Risk and Capital Management An ERM Update on the Global Insurance Industry

2 An ERM Update on the Global Insurance Industry I 1 TABLE OF CONTENTS Foreword 2 Introduction and Executive Summary 3 The Five Major Findings 4 One: Enterprise-Level Risk Management Has Come of Age 4 Two: ERM Is Ultimately About Creating Shareholder Value 5 Three: Economic Capital Is a Key Tool That Is on the Fast Track 6 Four: Enhanced Risk and Capital Management Are Already Making a Difference 9 Five: We re Not Done Yet 11 Additional Findings 23 Participants Profile 28 Appendix A: Select List of Participating Companies 30 Appendix B: Complete Survey Findings 31

3 2 I An ERM Update on the Global Insurance Industry FOREWORD Integrated risk and capital management is emerging as a source of competitive advantage in the insurance industry. The days of viewing risk and capital management as purely defensive business processes are nearing an end. Insurers have come to recognize enterprise risk management as fundamental to creating and improving shareholder value through better risk-based decision making and capital allocation. The Tillinghast business of Towers Perrin conducted its third biennial survey on risk and capital management issues in an effort to provide industry leaders with a better perspective on the state of risk and capital management approaches. Responses were received from 150 insurance industry executives worldwide. Overall, the survey confirmed that significant strides have been made over the last two years, but there remains much work to be done. As evidence of the growing importance of risk and capital management, survey respondents told us the following: Senior executives are giving integrated risk and capital management greater priority and attention than ever before, establishing high-level accountabilities befitting a legitimate strategic function. Risk management considerations have begun influencing business decisions in such mainstream areas as asset/investment strategy, product pricing, annual business planning and reinsurance purchasing. Economic capital is emerging as a critical tool in risk and capital management. While a prime senior executive objective is to create value through better risk-based decision making, most companies are still in the process of improving basic risk processes. We thank all those who participated in our most recent study for taking the time to share their thoughts on these important issues. We anticipate that senior insurance executives who read this report will find this information valuable in shaping their future risk management efforts as they strive to improve value for their organization. Tillinghast is committed to helping our clients add value through integrated risk and capital management. Our global Enterprise Risk Management (ERM) practice helps insurers leverage risk to create value. We provide senior management in particular, Chief Risk Officers innovative economic capital methodologies and proprietary techniques to understand, quantify and derive benefit from risk taking. Regards, Linda Chase-Jenkins Principal and Survey Leader Ian Farr Principal and Survey Leader

4 An ERM Update on the Global Insurance Industry I 3 INTRODUCTION AND EXECUTIVE SUMMARY The third Tillinghast biennial survey of risk and capital management practices among global insurers documents what many of us in the industry have already experienced: insurers around the world are moving ahead systematically and in some areas quickly to make integrated risk and capital management a strong driver of success in every major market and in every line of business. Our earlier surveys pointed to the promise inherent in this strategic approach to the holistic management of risk and capital at the enterprise level. This survey shows how that promise is starting to be fulfilled and what steps insurers are taking to complete this work in progress. In particular, developing economic capital as an important tool for quantifying risk and making risk-based decisions has taken center stage. The 2004 survey reveals five major findings regarding risk and capital management among insurers worldwide: Enterprise-level risk management has come of age. Insurers are giving enterprise-level risk management increasing attention, high-level accountability and clear responsibilities befitting a legitimate strategic function and discipline. ERM is ultimately about creating shareholder value. Insurers see the principal objectives for enterprise risk management (ERM) as helping them create and improve shareholder value through better risk-based decision making and capital allocation. Economic capital is a key decisionmaking tool that is on the fast track. Economic capital is becoming an important tool for insurers in guiding decision making at all levels in their organizations. Risk and capital management are already making a difference. Enhanced risk and capital management approaches are already guiding business decisions made by insurers and are likely to do so more frequently as their use increases in a wide variety of areas. We re not done yet. Despite the progress that insurers have made since we began these surveys, both risk management approaches and economic capital calculations are still very much works in progress with major gaps to fill; in particular, a standard methodology for calculating economic capital is still evolving. In addition to these major findings, this report documents risk management reporting practices and the level of success insurers have experienced when integrating risk and capital management with performance management. We also look at how satisfied insurers are with their core capabilities that underlie effective risk and capital management. The report details findings from our Web-based survey of chief risk officers (CRO), chief financial officers (CFO) and chief actuaries in insurance companies around the world that was conducted in the summer of Forty-seven percent of respondents came from North American-headquartered companies, 39% from Europe, 10% from Asia/Pacific and 4% from South America. Seventy-two percent of respondents are writing property/casualty business, 69% life/health business, 39% reinsurance, and 26% are active in other financial services. We are grateful to the 150 executives from around the globe who participated in this survey.

5 4 I An ERM Update on the Global Insurance Industry THE FIVE MAJOR FINDINGS ONE: ENTERPRISE-LEVEL RISK MANAGEMENT HAS COME OF AGE Four specific results from the 2004 survey make the compelling case that risk management is coming of age gaining the attention, high-level accountability and clear responsibilities that are the due of a legitimate strategic function and discipline. First, an overwhelming number of respondents (86%) say that enterprise-level risk management is more of a priority today than it was a year ago. Second, since our last survey in 2002, there has been a strong shift in the positioning of the risk management function within organizations. Among 39% of the 2004 survey respondents, a CRO has been given primary responsibility for risk management, an increase from 19% in 2002, when the CFO more frequently had such responsibility. Additionally, the person responsible for risk management now reports directly to the CEO in 49% of companies. That includes 40% of CROs who now report to the CEO, an increase from 26% in Third, the number of companies that have cross-functional risk management committees has also markedly increased. Currently, 63% of respondents report the existence of such committees in their companies, a significant increase from the 38% of industry executives who reported having an ERM committee in the 2002 survey (see Exhibit 1). EXHIBIT 1 Presence of Cross-Functional Risk Management Committee 20% No, and not considering 17% No, but considering 63% Yes Another 17% in the 2004 study said that they are considering the creation of a cross-functional risk management committee for their companies, compared to the 21% who said that they were thinking about establishing such a committee in Clearly, many of these respondents did create such a committee, as evidenced by the increase to 63% of companies who have them in These figures suggest that, very shortly, 80% of the industry will have cross-functional risk management committees. The survey data also shows that more companies have chosen to move away from the risk silo approach in order to improve communication on risk management throughout their organizations. This trend is particularly prevalent in Asia, Canada and Europe, where approximately 70% or more have set up such committees, while slightly less than half of U.S. respondents have established committees. Fourth, the 2004 survey results show that insurers are clearly delineating roles and responsibilities for eight key business processes, especially for managing market risk and insurance risk. These processes are: risk modeling and measurement; economic capital calculation; risk identification and prioritization; internal risk monitoring and reporting; risk control and mitigation; risk aggregation; external risk communication; and risk-related performance measures. For example, 89% of our 2004 survey respondents have implemented clearly defined and assigned roles and responsibilities for risk modeling and measurement when managing insurance risk, and 72% have done so for managing market risk. Similar percentages appear in the 2004 results for risk identification and prioritization, with 87% of respondents reporting clear lines of roles and responsibilities for insurance risk and 76% for market risks (see Exhibit 14, Roles and Responsibilities for Risk Management, on page 17, for additional findings). The notable exception to insurers creating clear roles and responsibilities for managing risk processes is in the quantification of operational risk. In this area, the numbers fall dramatically by roughly 25 to 50 percentage points regarding most operational risk management processes. For example, for risk-related performance measures in managing operational risks, only 29% of survey respondents reported clear lines of roles and responsibilities; for risk modeling and measurement, 30%; and for risk aggregation, 33% (also see Exhibit 14, page 17).

6 An ERM Update on the Global Insurance Industry I 5 TWO: ERM IS ULTIMATELY ABOUT CREATING SHAREHOLDER VALUE If risk management was at one time a strictly defensive activity for insurers, it no longer is. Insurers today see the principal objectives for ERM as helping them create and improve shareholder value through better risk-based decision making and capital allocation. In fact, 60% of the respondents in 2004 said that one of the top three objectives of ERM was to improve risk-based decision making, while half said their objective was to make more effective use of capital, and nearly 40% responded that they wanted to improve shareholder value (see Exhibit 2). Fewer respondents today cite defensive actions as one of their principal objectives for improving integrated risk management. Only 30% reported that their goal was to protect shareholder value. Only 26% overall cited comply with regulatory changes as a principal objective, although compliance with regulatory changes was an objective for 48% of European firms. Nine percent cited improve rating as a key objective and only 7% said manage implications from accounting changes. EXHIBIT 2 Key Objectives for Improving Risk Management 0% 20% 40% 60% 80% 100% Improve risk-based decision making More effective use of capital Improve shareholder value Protect shareholder value 30 Manage earnings volatility Comply with regulatory changes 26 Improve corporate governance 24 Manage tail risk 18 Improve communications 10 Improve rating 9 Manage implications from accounting changes 7 Other

7 6 I An ERM Update on the Global Insurance Industry A significant shift from 2002 to the present may be in the increasing importance of capital management for insurers. Using risk management to make more effective use of capital was the second leading objective cited by respondents to the current survey, whereas, in 2002, capital management allocation was only the eighth leading business issue for respondents. This highlights the growing importance of economic capital in today s marketplace, which is further described below. THREE: ECONOMIC CAPITAL IS A KEY TOOL THAT IS ON THE FAST TRACK The 2004 study clearly shows how important and widespread economic capital has become in the global insurance industry. An overwhelming majority of respondents, in fact, state that they either use, or plan to use, economic capital to improve capital allocation and risk-based decision making. Specifically, 53% of respondents are currently using economic capital as a critical decisionmaking tool and 28% plan to do so (see Exhibit 3). EXHIBIT 3 Companies Using Economic Capital 19% No 28% Considering 53% Yes Currently, economic capital is widely used in risk-based decision making at the company, business unit and product level around the globe. Roughly threequarters of respondents use economic capital in actual organizational decision making. In particular, of those already using economic capital: 75% use economic capital to allocate capital at the company level, 70% at the business unit level, and 53% at product level. 74% use economic capital at the company and business unit levels to measure risk-adjusted performance, while 50% use economic capital at the product level for that purpose. 74% use economic capital at the company level to make strategic or tactical decisions; 58% do so at the business level, and 30% at the product level. 90% of respondents use economic capital in product design and pricing. Industry executives also use economic capital calculations to communicate at the company level with shareholders, rating agencies and regulatory bodies. Such communication is widespread, with the focus being on shareholders (96%), rating agencies (92%) and regulators (84%). Regional Differences in Current Practice While there is widespread agreement around the globe about the desirability of using economic capital in risk management programs and strong similarities in the way global insurers currently use economic capital, there are some clear regional differences in the way insurers define liabilities in their economic capital calculations and in the measures they use to determine their level of risk tolerance.

8 An ERM Update on the Global Insurance Industry I 7 The ultimate aim of calculating economic capital is to arrive at a realistic economic measure of the amount of capital defined as assets in excess of liabilities that a firm needs to cover losses at a certain risk tolerance level, irrespective of regulatory rules or accounting conventions. But the use of economic capital by North American companies appears at this point to be driven primarily by regulatory requirements and rating agency views towards capital, rather than a purely economic view of capital. That is, North American companies are responding mainly to external pressures. Executives in other regions, especially in Europe, are more likely to use economic definitions of liabilities in their calculations of economic capital, both for internal purposes and in preparation for the new insurance accounting standards (IAS) accounting requirements. The North American bias toward a regulatory view is clear in the way that firms define the liabilities they include in economic capital calculations. In aggregate, 41% of our respondents define them as regulatory or statutory liabilities. But in North America, the number goes up to 55% and in Europe, it is just 28%. EXHIBIT 4 How Insurers Defined Liabilities in Economic Capital Calculations 0% 10% 20% 30% 40% 50% Statutory or regulatory liabilities Best estimate liabilities Mark-to-market liabilities GAAP liabilities Other % of total respondents define them as GAAP liabilities, but that number is 13% in North America and only 7% in Europe. 40% of all respondents define them as economically determined liabilities in the following ways: 22% as best estimate liabilities and 18% as mark-tomarket liabilities, while 9% use other definitions. But in North America, only 28% of the 2004 respondents use pure economic definitions of liabilities, while in Europe, 52% of companies use such economic definitions and, in Asia, 55% do (see Exhibit 4). 41 We believe the best practice for determining economic capital is to look beyond statutory requirements to a more realistic economic measure, independent of accounting and regulatory biases. Economic measures are intended to provide a better representation of the reality of the business.

9 8 I An ERM Update on the Global Insurance Industry Insurers around the world currently also use a wide variety of measures to determine their risk tolerance levels, with significant differences by region and line of business. Overall, among all respondents to the 2004 survey, 49% use probability of ruin as their primary risk tolerance measure, but that percentage varies widely by region: 76% in Europe, 44% in Asia and only 33% in North America. Overall, 31% of companies use tail value at risk (TVAR) or conditional tail expectation (CTE) as their primary risk tolerance measures. In North America, the number is 48%, compared to 14% in Europe and 22% in Asia. Forty-three percent of life/health companies use these measures, compared to 26% of P/C companies (see Exhibit 5). We believe there are a number of explanations for the variation in risk tolerance measures. First, different regions have different drivers for the use of economic capital. For example, as we saw earlier, North American companies are much more attuned to rating agency and regulatory considerations for determining economic capital. For that reason, too, they are more likely to measure risk tolerance based on TVAR or CTE, since that is what regulators in North America most often request. The Canadian regulator (OSFI) introduced the use of a CTE measure for defining required EXHIBIT 5 How Insurers Measure Risk Tolerance 0% 10% 20% 30% 40% 50% Probability of ruin Tail value at risk (TVAR) or conditional tail expectation (CTE) Below target risk Economic cost of ruin Value at risk 3 Other capital on segregated fund products in In the U.S., proposed regulation expected to be enacted by year-end 2005 for variable annuity risk-based capital and reserves will also be based on CTE measures. Second, the different ways that insurers use economic capital account for some of the variation in measures. As we saw above, currently the predominant use of economic capital is to communicate with shareholders, regulators and rating agencies. This use may explain why so many companies, especially in Europe, use probability of ruin as their key measure of economic risk. This is easier to explain to stakeholders than other measures, such as below-target risk or economic cost of ruin. Thus, at this stage in the development of economic capital as a strategic tool for insurers, some industry executives may be making a trade-off between the technical sophistication of a measure and its internal and external explainability. A clear communication of methodology and rationale for setting economic capital should do more to help increase shareholder value than technical sophistication. We would expect that the methodologies for developing and implementing economic capital will be further enhanced over time, making economic capital a standard tool for risk and capital management in insurance companies worldwide.

10 An ERM Update on the Global Insurance Industry I 9 FOUR: ENHANCED RISK AND CAPITAL MANAGEMENT ARE ALREADY MAKING A DIFFERENCE Enhanced risk and capital management approaches are already influencing key decision making in major areas of the insurance business. For instance, insurers report that risk management considerations have caused them to change business decisions in such critical areas as (see Exhibit 6): Asset/investment strategy (64%) Product pricing (61%) Annual business planning (53%) Reinsurance purchase (51%) Strategic planning process (50%) Product design (47%) Product/business mix (40%). EXHIBIT 6 Business Decisions Affected by Risk Management Considerations 0% 20% 40% 60% 80% 100% Asset/investment strategy Product pricing Annual business planning Reinsurance purchase Strategic planning process Product design Product/business mix M&A and divestiture 22 Policyholder bonus/crediting policy 19 Market entry 13 Not applicable/none Other 3

11 10 I An ERM Update on the Global Insurance Industry Moreover, the 2004 survey results suggest that the effects of risk management strategies on business decisions will likely increase because of the widening use of risk and capital management tools by industry executives. For instance, 67% of respondents said that they currently use these tools for asset/investment strategy, while another 19% plan to do so in the next 12 to 24 months. In product pricing, 62% of insurers already use risk and capital management tools and another 22% say they will do so in the next two years. In annual business planning, the number of executives who already use these tools is 60%; those who plan to do so, 25%; for business reinsurance purchasing, the figure for current usage is 59%, and those planning to begin usage, 22%. Fifty-two percent reported using risk and capital management tools in their strategic planning process and 29% more said that they plan to do so. In product design, 52% of industry executives said that they currently employ these tools, and another 23% expect to do so. For product/business mix decisions, the numbers were 48% for current usage and 27% for planned usage (see Exhibit 7). EXHIBIT 7 How Insurers Use and Plan to Use Risk and Capital Management Tools 0% 20% 40% 60% 80% 100% Asset/investment strategy Product pricing Annual business planning Reinsurance purchasing Strategic planning process Product design Product/business mix M&A and divestiture Policyholder bonus/crediting policy Market entry Currently using Plan to use in next months Do not use and have no future plans to use In addition, insurers are planning to take specific actions to optimize asset liability risk and return trade-off. Their plans include closer duration matching (68%), purchasing derivative instruments (39%) and dynamic hedging (29%).

12 An ERM Update on the Global Insurance Industry I 11 FIVE: WE RE NOT DONE YET Clearly, insurers have made great progress, especially over the past two years, in using integrated risk management processes and economic capital to improve risk-based decision making at all levels of their organizations. But it is also clear that holistic risk management, especially using economic capital as a critical tool, is still a work in progress. RISK MANAGEMENT It is clear from the specific survey results that enterprise-level risk management is still a work in progress. Gap Between Objectives and Current Efforts First, a gap exists between what insurers want ERM to do and what they are currently doing to improve their efforts. As we saw in Finding Two, insurers want ERM to help build shareholder value through improved decision making, especially for using capital more effectively. But the leading current improvement efforts of insurers still focus on some of the fundamentals of integrated risk management, for example, improving internal risk reporting procedures (67%), improving the measurement and quantification of insurance risks (66%), and improving risk identification and prioritization processes (63%). Current risk management improvement efforts focus less on the more sophisticated and advanced actions that would ensure an organization s ability to create shareholder value. Only about 40% are incorporating economic capital considerations and risk management into regular decision making, and less than 10% are incorporating risk considerations into incentive compensation (see Exhibit 8). EXHIBIT 8 Focus on Risk Management Improvement Efforts 0% 20% 40% 60% 80% 100% Improving internal risk reporting processes 67 Improving the measurement and quantification of insurance risks 66 Improving risk identification and prioritization processes 63 Improving economic capital calculations 57 Ensuring risk management considerations are explicitly factored into decision making 57 Improving the measurement and quantification of operational risks 54 Improving the education and communication of risk management principles and approach 51 Improving the measurement and quantification of market risks 49 Ensuring economic capital considerations are explicitly factored into decision making 43 Improving integration of risk management into day-to-day operations 39 Risk management organizational changes 37 Acting to mitigate earnings volatility 33 Mitigating tail risk 30 Incorporating risk considerations into incentive compensation 7 Other 4

13 12 I An ERM Update on the Global Insurance Industry Variety of Factors to Measure Risk Impact A second indication that integrated risk management remains a work in progress shows up in the variety of different bases that insurers primarily use to measure the impact of risk. About one-third use regulatory or statutory bases; a little more than 20% use a GAAP or IAS basis, while just under 40% use an economic basis (see Exhibit 9). The choice of basis gives an indication of the orientation of the company in terms of its risk focus. The use of regulatory or statutory bases suggests a focus on regulatory compliance and policyholder protection. The use of GAAP and IAS bases suggests a focus on shareholder interests, but only to the extent that these are represented by published accounting statements. Use of an economic basis signifies recognition that neither regulatory nor accounting statements are perfectly aligned with the interests of policyholders and shareholders. Thus, an economic basis gives a more comprehensive and sophisticated understanding of the totality of risks to which the firm is exposed. And for this reason, we believe using an economic basis constitutes a best practice that we think more insurers will move to. EXHIBIT 9 Factors Insurers Use to Measure Impact of Risk 0% 10% 20% 30% Statutory or regulatory capital and surplus Economic value GAAP or IAS earnings Statutory or regulatory profits Economic profit Embedded value 5 Embedded value earnings 3 GAAP or IAS equity 3 Ability to pay claims when due 3 Other

14 An ERM Update on the Global Insurance Industry I 13 Variety of Risk Metrics There are also similar signs that integrated risk management continues to be a work in progress in the various metrics that insurers around the world use to measure and quantify risk. Asset/liability durations are the most generally used metric, by 59% of all respondents. Economic capital is used by just over half (51%). Other measures are used by less than half of our respondents: earnings volatility by 49%; asset concentration by 49%; value at risk by 43%; tail value at risk (TVAR) or conditional tail expectation (CTE) by 34%; earnings at risk by 31%; asset/liabilities convexities by 26%; asset/liability Greeks by 15% (see Exhibit 10). Different risks can require different metrics for their quantification. Therefore, to some degree we would expect to find a variety of metrics in a robust risk management program. In addition, different regulatory and business environments may also require different metrics. That seems to be the case with TVAR used by 50% of North American companies, largely because of regulatory concerns, compared to 21% of European companies. It is also somewhat the case for value at risk, which is much more likely to be used by European companies than companies in other regions. And it seems to be the case for earnings EXHIBIT 10 Metrics That Insurers Use to Quantify Risk 0% 20% 40% 60% 80% Asset/liability durations Economic capital Earnings volatility Asset concentration Value at risk Tail value at risk (TVAR) or conditional tail expectation (CTE) 34 Earnings at risk Asset/liability convexities Asset/liabililty Greeks 15 Other volatility, which is used by 65% of North American companies which are somewhat more sensitive to and driven by shareholder expectations compared to 36% of European companies. But some of the variety also seems to reflect insurers trying out increasingly sophisticated measures to quantify risk. That is clearest in the metrics associated with measuring asset/liability risk The majority of companies use the simplest metric, asset/liability durations, for measuring this risk. But a sizable and we suspect growing minority are using much more technically sophisticated measures as well: asset/liability convexities (26%) and asset/liability Greeks (15%). They may very well be at the leading edge of this work in progress.

15 14 I An ERM Update on the Global Insurance Industry Risks Included and Not in Risk Processes A fourth indication that integrated risk management remains a work in progress for insurers is their report on the risks they include in their risk management processes and those that they quantitatively measure. Overall, insurers are more likely to include market and insurance risks in their risk management programs than operational risks (see Exhibit 11). For example, for market risks: 73% include equity risk. 89% include interest rate risk. 71% include credit (asset default) risk. For insurance risks: 69% of all companies include lapse/ surrender risk 49% of P/C companies do that and 88% of life/health. 69% of all companies include mortality/longevity risk 54% of P/C companies and 88% of life/health. 65% of all companies include underwriting risk 69% of P/C companies and 64% of life/health. 64% of all companies include catastrophe risk 83% of P/C companies and 52% of life/health. But for operational risks: Only 63% of all respondents include event risks, such as technology failure and fraud. Just 51% include business risks, such as risks arising from sales practices, distribution, key person loss. EXHIBIT 11 Risks Included in Risk Management Processes 0% 20% 40% 60% 80% 100% Interest rate Equity Credit (asset default) Mortality/longevity Lapse/surrender Underwriting Catastrophe Liquidity Event Credit (counterparty) Business Morbidity Currency Non-life claims Property/real estate Other policyholder behavior None of the above

16 An ERM Update on the Global Insurance Industry I 15 Similarly, insurers are more likely to quantitatively measure market and insurance risks than operational risks. For example, for those who include these market risks in their risk management programs: 94% quantitatively measure interest rate risk; 84% measure equity risk; 79% measure credit (asset default) risk; 78% measure currency risk, and 72% measure liquidity risk. For those who include these insurance risks: 84% measure mortality/longevity; 83% measure non-life claims; 72% measure morbidity; 72% measure lapse/ surrender; 71% measure catastrophe risk, and 48% measure underwriting risk. But for those who include operational risks in their risk management processes, only 37% quantitatively measure event risk and only 29% measure business risk (see Exhibit 12). The findings suggest, first, that there are still a number of risks that many insurers who wish to practice holistic risk management have not yet incorporated into their risk management processes (especially operational risks) and second, that many insurers remain challenged to quantitatively measure important risks operational, to be sure, but also insurance risks. EXHIBIT 12 Risks That Insurers Are Likely to Measure 0% 20% 40% 60% 80% 100% Interest rate n=133 Equity n=110 Mortality/longevity n=104 Non-life claims n=65 Credit (asset default) n=106 Currency n=73 Property/real estate n=57 Liquidity n=94 Morbidity n=75 Lapse/surrender n=103 Catastrophe n=96 Credit (counterparty) n=93 Underwriting n=98 Other policyholder behavior n=49 Event n=95 Business n=77 None of the above n=

17 16 I An ERM Update on the Global Insurance Industry The findings also help illuminate why so many insurers say they will focus their risk management improvement efforts on their ability to quantify these risks. As we saw earlier, 66% say they will focus on improving the measurement and quantification of insurance risks; 54% will focus on improving the measurement of operational risks, and 49% say they will focus on improving the measurement of market risks. Risk Aggregation Underdeveloped A fifth indication that integrated risk management is still a work in progress and perhaps the most telling sign is the underdeveloped use of risk aggregation, supposedly the sine qua non of holistic risk management. EXHIBIT 13 Risk Monitoring 0% 20% 40% 60% 80% 100% Compliance with internal risk guidelines Key risk exposures by risk category Compliance with external risk guidelines Key risk exposures at entity aggregate level Key risk exposures at global aggregate level 39 Other 2 None of these For instance, the most prevalent answer to the question, What methodology do you use for aggregating risk? is None. That answer is tied (at 31%) with multiple risks are included in stochastic modeling. Another quarter of respondents use a correlation matrix to aggregate risk, and 13% use a variety of other methods. Insurers also do not monitor aggregate risks to the degree one would expect if they were implementing a true holistic risk management system. For instance, only 51% monitor key risk exposures at an entity aggregate level. Even fewer 39% monitor at the global aggregate level. Both aggregate risk monitoring approaches trail (see Exhibit 13): Monitoring compliance with internal risk guidelines a practice followed by 83% of our respondents Monitoring risk exposures by risk category followed by 73% Monitoring compliance with external risk guidelines, such as Sarbanes-Oxley followed by 65%. Moreover, insurers express the least satisfaction with their capability to aggregate risks across functions or businesses. Only 7% say they are very satisfied with this organizational capability. In fact, they give this capability an average score of 2.15 out of a possible 5, making this one of the lowest-ranked capabilities out of 20 assessed by our respondents. Finally, the widening use of ERM committees, which is a sound step in and of itself, does suggest that, at present, insurers are attempting to use an organizational structure to make up for the lack of tools and other technical capabilities to aggregate risks. That is, they may be attempting to capture aggregated risks by literally getting all of the risk owners in the same room, rather than attempting to use sophisticated modeling tools.

18 An ERM Update on the Global Insurance Industry I 17 Gap in Managing Operational Risks A sixth indication of the work that remains to be done on holistic risk management is a continuing major gap in managing operational risks. As we documented earlier, roles and responsibilities for managing operational risks are less clearly defined than for market and insurance risks. Responsibility for risk identification, internal risk monitoring and risk control for operational risks are most prevalent among all companies: risk identification (72%), internal risk monitoring (65%), and risk control (63%) (see Exhibit 14). But only about one-third of respondents, or less, have clearly delineated the other roles and responsibilities for managing operational risks: risk modeling (30%), economic capital calculation (33%), risk aggregation (33%), and risk-related performance measures (29%). EXHIBIT 14 Risk Management Processes With Clearly Defined Roles and Responsibilities 0% 20% 40% 60% 80% 100% Risk identification and prioritization External risk communication Internal risk monitoring/reporting Risk modeling/measurement Risk control and mitigation Economic capital calculation Risk aggregation 30 Risk-related performance measures Market Risk Insurance Risk Operational Risk

19 18 I An ERM Update on the Global Insurance Industry Insurers also express less satisfaction with the tools and techniques to manage operational risks, as well as their overall capability to manage them, than for nearly any other set of risk management tools, techniques and capabilities (see Exhibit 15). For example: Only 10% are very satisfied with the tools and techniques they have to manage event risks; the mean score of 2.47 for these tools ranks them second lowest out of 16 tools and techniques. Only 12% are very satisfied with tools and techniques to manage business risks; the mean score of 2.38 for these tools ranks them third lowest. Only 10% are very satisfied with their capability to quantify the important operational risks; the mean score of 2.2 for this capability ranks it third lowest out of 20 capabilities assessed by respondents (see Exhibit 26, page 27). EXHIBIT 15 Tools and Techniques to Manage Risk With Lower Levels of Satisfaction 0% 20% 40% 60% 80% 100% Morbidity n= Credit (counterparty) n= Underwriting n= Property/real estate n= Lapse/surrender n= Business n= Event n= Other policyholder behavior n= High (5) Medium (3) Low (1) Our respondents dissatisfaction with these tools is in marked contrast to their general satisfaction with most of the tools and processes for managing market and insurance risk.

20 An ERM Update on the Global Insurance Industry I 19 For example, for market risk: 48% are very satisfied with the tools and techniques to manage interest rate risk, giving this capability a mean score of 3.84, which makes it the highestrated set of tools and techniques. 45% are very satisfied with the tools and techniques to manage currency risk, giving this capability a mean score of 3.68, making it the second highestrated set of tools. 43% are very satisfied with the tools to manage liquidity risk, giving this capability a mean score of 3.47, making it the third highest-rated set of tools. For insurance risk: 39% are very satisfied with the tools to manage mortality/longevity risk, giving this capability a mean rating of % are very satisfied with the tools to manage catastrophe risk, giving this capability a mean rating of % are very satisfied with the tools to manage risk from non-life claims, giving this capability a mean rating of 3.52 (see Exhibit 16). EXHIBIT 16 Tools and Techniques to Manage Risk With Higher Levels of Satisfaction 0% 20% 40% 60% 80% 100% Interest rate n=133 Currency n=73 Liquidity n=94 Equity n=110 Credit (asset default) n=106 Mortality/longevity n=104 Catastrophe n=96 Non-life claims n=65 High (5) Medium (3) Low (1)

21 20 I An ERM Update on the Global Insurance Industry EXHIBIT 17 Goals of Improvements in Economic Capital Plans for Further Improvements 13% No 87% Yes Goals of Planned Improvements 0% 20% 40% 60% 80% 100% Improving the modeling or measurement capabilities 89 Improving the applications of economic capital 71 Extending the risks covered 61 Including correlation factors 34 Improving the buy-in of stakeholders 30 Other 3 ECONOMIC CAPITAL Targeted Improvements While calculating and using economic capital is now relatively common, it is clear that there is no standard methodology and that the techniques are still evolving. Insurers overwhelmingly say they have more work to do and have a good idea of what that work is. Nearly all (87%) say they intend to improve their economic capital calculations and methodology by: Improving their modeling or measurement capabilities 89% for all respondents. Ninety-six percent of European companies say they are planning to do so; 81% of North American companies intend to do so. Improving the applications of economic capital 71% for all respondents. Eighty-two percent of European companies will make this process an improvement focus; only 56% of North American companies will do so a finding that suggests that North American companies still need to get more of the basic economic capital processes in place before they can improve applications of economic capital. Extending the risks covered 61% for all respondents. Forty-eight percent of European countries will do so, a finding that is consistent with the fact that European companies already include more risks in their economic capital calculations than do North American companies. Seventy-two percent of North American companies will do so, suggesting that this aspect is one of the critical, fundamental areas that they will have to improve before extending the applications of economic capital. Other areas targeted for improvement are: including correlation factors (34%) and improving the buy-in of stakeholders (30%) (see Exhibit17).

22 An ERM Update on the Global Insurance Industry I 21 Risks Included in Economic Capital Calculations The emphasis on extending the risks covered by economic capital calculations, especially for North American companies, makes a good deal of sense in light of insurers current practice, whereas, with risk management, they are more likely to include market and insurance risks in the calculations than operational risks (see Exhibit 18). For market risks: 90% include interest rate risks in economic capital calculations. 79% include equity risks. 69% include credit (asset default) risks. 50% include currency risk. 49% include counterparty credit risk. 45% include property/real estate risk. 33% include liquidity risk. For insurance risks: 60% of all respondents include mortality/longevity risk 43% of P/C companies include this risk and 86% of life/health. 60% of all respondents include lapse/surrender risk 48% of P/C companies include it and 75% of life/health. 51% of all respondents include catastrophe risk P/C, 79% and life/health, 25%. 49% of all respondents include morbidity risk P/C, 33% and life/health, 75%. 48% of all respondents include non-life claims risk P/C, 76% and life/health, 14%. EXHIBIT 18 Risks Included in Economic Capital Calculations 0% 20% 40% 60% 80% 100% Interest rate Equity Credit (asset default) Mortality/longevity Lapse/surrender Catastrophe Currency Morbidity Credit (counterparty) Non-life claims Underwriting Property/real estate Event Business Liquidity Other policyholder behavior % of all respondents include underwriting risk P/C, 62% and life/health, 32% % of all companies include other policyholder behavior P/C, 14% and life/health, 29% But for operational risks: 90 Only 36% include event risks. And only 35% include business risks.

23 22 I An ERM Update on the Global Insurance Industry Barriers to Improvement Even though insurers say they intend to continue to improve their ability to use ERM and economic capital in decision making, they also cite important barriers to doing so. For example, insurers cite a number of barriers specifically to using economic capital and its applications more extensively, including resource issues (61%), modeling/measurement issues (47%), data or information systems (28%), complexity of economic capital (21%), lack of clarity about goals and objectives (19%), results not considered reliable enough (15%) and value not clear (7%) (see Exhibit 19). Insurers cite similar barriers to using risk (as well as economic capital) tools more extensively in decision making: resource issues (62%), modeling/measurement tools are not sophisticated enough (34%), organizational barriers between areas that develop models and those where decisions are made (28%), do not have confidence in the results (19%) and have only just started risk and capital management (2%) (see Exhibit 20). EXHIBIT 19 Reasons for Not Using Economic Capital More Extensively 0% 20% 40% 60% 80% Resource issues Modeling/measurement issues Data or information systems 28 Too complex 21 Lack of clarity of objectives or benefits 19 Results not considered reliable enough 15 Don t see the value of it 7 Economic capital extensively used 2 Not applicable 6 Other 7 EXHIBIT 20 Reasons Risk Management and Economic Capital Are Not Used More in Decision Making 0% 20% 40% 60% 80% Resource issues 62 Modeling/measurement tools aren t sophisticated enough 34 Organizational barriers exist between areas that develop/run models and where business/strategic decisions are made 28 Don t have confidence in the results 19 Have just started risk and capital management 2 Not applicable 7 Other

24 An ERM Update on the Global Insurance Industry I 23 ADDITIONAL FINDINGS Our survey also uncovered three additional areas where insurers will need to do more work to effectively implement ERM, including economic capital, in their organizations: Performance management Reporting and monitoring Capability development. PERFORMANCE MANAGEMENT While insurers have made significant progress in creating appropriate organizational structures for ERM and delineating roles and responsibilities, especially for managing risk, they still have not gone very far in integrating risk and capital management with their organizations performance management systems. In our view, until they do, they will have great difficulty in realizing their objective of improving decision making with these tools. For example, 57% of our respondents indicated that they do not incorporate risk measures into their organizations incentive compensation systems at all. That is, three out of every five insurance companies today make no systematic attempt to link risk management with pay. Yet we live in a pay-for-performance world, and this measure provides the possibility of truly being able to pay for performance (see Exhibit 21). EXHIBIT 21 Risk Measures and Incentive Compensation 0% 20% 40% 60% Performance targets include return on risk-based or economic capital 20 Breach of risk guidelines attracts a penalty 17 Performance targets include increase of risk-adjusted value measure 11 Other 3 Not applicable Of the minority of companies (43%) who do link pay and risk management, 47% say their performance targets include return on risk-based or economic capital. Twenty-five percent say their performance targets include an increase of riskadjusted value measure, and just 39% say they impose penalties for breaching risk guidelines. In other words, for the vast majority of companies, there is no carrot for using risk measures in decision making, and there is no stick for violating risk policies. REPORTING AND MONITORING As we saw earlier in the major findings, improving internal risk reporting is now a major focus for insurers. That makes a great deal of sense, based on insurers current practice of reporting and monitoring risk management activity. In our view, a great many insurers do not report frequently enough, consistently enough, or use the most appropriate means of doing so. That is true for reports on risk 57 to directors and for reports to senior management those charged with strategic decision making for the enterprise. For instance, more than 40% of our respondents say they report on risk to their directors fewer than four times a year. In fact, 16% say they do not report on risk at all to their directors; 5% report semiannually, and 19% report annually. The good news for the industry is that about half (48%) of global insurers report on risk to their directors quarterly, and 8% report monthly. The majority of reporting practices with senior management also do not represent best practice in our view. Only 40% report monthly; 34% report quarterly; 3% semiannually; 9% annually, and 8% not at all. It is difficult to see how

25 24 I An ERM Update on the Global Insurance Industry EXHIBIT 22 Frequency of Internal Reporting Board of Directors 0% 10% 20% 30% 40% 50% Once a month 8 Once a quarter Twice a year 5 Once every year Other 4 Do not formally report Senior Management 0% 10% 20% 30% 40% 50% Once a month Once a quarter Twice a year 3 Once every year 9 Other 6 Do not formally report insurers will use risk management to improve decision making if executives do not have timely information about the risks they are supposed to manage (see Exhibit 22). In our view, too, the methods of reporting in the industry are, for the most part, not conducive to good decision making. For example, only 29% say they use risk dashboards for reporting, a tool that in our experience helps managers quickly grasp the information they need to make better decisions. Seventy-eight percent say they make regular reports to the executive committee and the board though, as we saw above, regular can cover a great deal of territory in the industry. Forty-nine percent say they report risks on an ad hoc basis; 33% make reports to the CRO, and 21% say they use regulatory risk formats in their internal reporting (see Exhibit 23). EXHIBIT 23 How Insurers Report Internally 0% 20% 40% 60% 80% 100% Regular reports to executive committee/board of directors On an ad hoc, as-needed basis Regular reports to the CRO Use of risk dashboards at the business or corporate level 29 Use of regulatory reporting forms 21 Other

26 An ERM Update on the Global Insurance Industry I 25 Insurers also report gaps in what they monitor and report, which makes improving decision making a more difficult task. For example, 83% say they monitor compliance with internal risk guidelines. But that means 17% of the industry worldwide do not take steps to see to it that their own people comply with their own rules on risk. That especially appears to be the case in North America, where just 78% say they monitor compliance with internal guidelines. In Europe, 90% monitor compliance. As for compliance with external risk guidelines, such as Sarbanes-Oxley, only 65% of respondents say they do so: 69% do so in North America, and 71% in Europe. EXHIBIT 24 What Insurers Monitor 0% 20% 40% 60% 80% 100% Compliance with internal risk guidelines Key risk exposures by risk category Compliance with external risk guidelines Key risk exposures at entity aggregate level Key risk exposures at global aggregate level 39 Other 2 None of these In other areas that insurers should monitor in order to enable better decision making: 73% monitor key risk exposures by risk category 79% in Europe and 65% in North America. 51% monitor aggregate risk exposures at the entity level. Only 39% monitor aggregate risk exposures at the global level (see Exhibit 24).